mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
42 lines
1.4 KiB
JSON
42 lines
1.4 KiB
JSON
{
|
|
"category": [
|
|
"Adversary Tactics"
|
|
],
|
|
"channel": "ESCU",
|
|
"creation_date": "2016-09-13",
|
|
"description": "Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.",
|
|
"detections": [
|
|
{
|
|
"detection_id": "e0aad4cf-0790-423b-8328-7564d0d938f9",
|
|
"name": "SQL Injection with Long URLs",
|
|
"type": "splunk"
|
|
}
|
|
],
|
|
"id": "4f6632f5-449c-4686-80df-57625f59bab3",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"modification_date": "2017-09-19",
|
|
"name": "SQL Injection",
|
|
"narrative": "It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.\\\nThis Analytic Story contains a search designed to identify attempts by attackers to leverage this technique to compromise a host and gain a foothold in the target environment.",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://www.owasp.org/index.php/SQL_Injection",
|
|
"https://www.owasp.org/index.php/Blind_SQL_Injection",
|
|
"https://www.incapsula.com/web-application-security/sql-injection.html"
|
|
],
|
|
"spec_version": 2,
|
|
"usecase": "Advanced Threat Detection",
|
|
"version": "1.0"
|
|
}
|